16 ms·

Bluetooth relay attacks allow Tesla Model 3 / Y to be unlocked and driven away

233 points by youngtaff 4y ago

Ndymium 4y ago
This seems to be already discussed here: https://news.ycombinator.com/item?id=31403925 https://news.ycombinator.com/item?id=31403925
bjt2n3904 4y ago
I've never understood car makers obsession with proximity unlock. Let's put it this way: I use biometrics for my phone as convenience, but I have it time out in an hour, and require a pattern. (Or, if I put the phone in lockdown.) The security biometrics offer is too weak to trust. But imagine if the only option you had was face id, and all other options were removed. Operations like unlocking the door must be explicit, not implicit. I'd accept configurability, but it would be permanently disabled if I could. Bluetooth has always sucked, but even if Bluetooth is improved, proximity unlock is brain dead for security.
- diebeforei485 4y ago
  Auto-lock when out of proximity is a great feature.
  - bjt2n3904 4y ago
    It absolutely is! Locking can be implicit -- the assumption should be that the user wants things secure. But imagine working for a company that is very excited about their AI firewall, that intelligently OPENS ports based on a machine learning algorithm. "No! That's a terrible idea!" You exclaim, pulling out tufts of hair. "That has more security holes than a slice of swiss cheese!" "Yeah, but all our focus groups really liked the feature, and when customers hear AI and algorithms they're more likely to buy... Come on, you'd have to basically have a PhD to exploit an algorithm...."
    - roomey 4y ago
      Not to be facetious but there are security products advertised as such (intelligent learning of application behaviours etc etc.
- the_mitsuhiko 4y ago
  > I've never understood car makers obsession with proximity unlock. Presumably because the feature is well liked. I rarely every use the buttons on my keyfob but always use proximity lock/unlock because it's just much more convenient in practice.
  - Ekaros 4y ago
    I would love to have it. It would mean that I would not need to remove key from my pocket if there was also push to start. It always annoys me when I'm carrying something having to fumble and get it out of pocket. Just to press button and then insert it.
  - dzhiurgis 4y ago
    My car ties the keys to seat memory - since we share car it's super nice not to fiddle with that. Also just having it somewhere in your pocket, doesn't require you to search for it.
- dotancohen 4y ago
  > I've never understood car makers obsession with proximity unlock. The competition has it. Some people like it. And in Tesla's case, it saves money. There is no cylinder on the steering column, no cylinder in the door, no steel key to manufacture, no rod going to a physical unlock switch, and no physical unlock switch. So we've saved 500 grams in the car and probably a good $20 too, no to mention the room in the door for the rod and the physical switch, which add engineering work. There is a long tail of removing grams and dollars from the car manufacturing process, and 500 grams and $20 is significant. This long tail is why e.g. the Model 3 uses a touch screen for most controls, why the rear glass extends far into the roof, and many other seemingly-"premium" features of the Model 3. It's actually cheaper to manufacture them this way.
  - riffraff 4y ago
    but why use _proximity_ ? You may just as well require a click on the key fob or phone, the cost savings would be exactly the same.
    - brianwawok 4y ago
      It’s great. Walk up to car get in and push gas. Stop it and walk away. No locks to fiddle with, it just works.
  - bjt2n3904 4y ago
    > And in Tesla's case, it saves money. There is no cylinder on the steering column, no cylinder in the door... This is precisely what I mean by "brain dead". You'll forgive the hostility, but this is exactly what I'm talking about! Nothing about this list of things REQUIRES proximity unlock. You can still require the user to push a button on their key fob to explicitly unlock the door. I get the convenience factor, I do. If that's a feature you enjoy, then great! All the happiness for you. But give me the chance to opt out of something that is deeply broken from a security perspective. Let me press a fscking button to unlock my car, instead of my car deciding I probably want it to unlock.
    - 4y ago
- Tepix 4y ago
  My latest car has it and it wasn't optional. I had to buy a faraday bag for my car key.
- yreg 4y ago
  Proximity unlock is one of my favourite features of my car. I live in a safe region and don't mind having my car unlocked when I'm near it. If it was manual I wouldn't lock it anyway. I agree that it should be configurable, which on Teslas I believe it is.
- is_true 4y ago
  People love the feel of smart things and a car that unlocks itself when you get close does that. It's your own butler, it makes you feel important.
- msh 4y ago
  Proximity unlock makes a huge difference when you have a kid on one arm and groceries on the other. You might still be able to operate the doorhandle without putting stuff down but not fiddle around in your pockets. Also teslas dont force proximity unlock, its up to you to set it up.
bin_bash 4y ago
Seems to me the purpose-built NFC spec (used by Apple CarKey) is what Tesla should switch to for this (https://www.businesswire.com/news/home/20200504005161/en/Car-Connectivity-Consortium-Launches-Its-Digital-Key-Release-2.0-Specification https://www.businesswire.com/news/home/20200504005161/en/Car...)
- dotancohen 4y ago
  Tesla cannot rely on this hardware existing on all devices they target, which include low-end Android devices.
  - bin_bash 4y ago
    Therefore they should use this insecure option for everyone? It's possible to have more than 1 radio you know.
    - brianwawok 4y ago
      You can also enable pin to drive. Requires a pin in the car to move it,
  - nowherebeen 4y ago
    If you can afford to buy a Tesla, your chances of owning a low-end Android phone is low. I am sure Tesla owners wouldn’t mind buying a new phone for a few hundred bucks to make their car more secure.
    - petepete 4y ago
      Couldn't they just include a dedicated NFC fob? Almost back to the idea of carrying keys around!
      - ashray 4y ago
        They do. Teslas come with two NFC card keys. The phone unlock is optional but really convenient.
diebeforei485 4y ago
This has been an issue with Teslas for a while. Sounds like poor decision-making to use Bluetooth for this. Bluetooth plus UWB (Apple Wallet implementation for some Mercedes models) or Bluetooth plus [ad-hoc] Wi-Fi are reasonable solutions.
- AshamedCaptain 4y ago
  Maybe UWB is more difficult to relay, but what would exactly Wi-Fi bring to the table ?
  - diebeforei485 4y ago
    Time-of-flight calculations so relay attacks wouldn't work well anymore.
- mhoad 4y ago
  Exactly the kind of engineering team I want in charge of self driving vehicles all over the streets.
  - jiggawatts 4y ago
    This may sound like a flippant comment, but it cuts to the heart of the matter: In every aspect, Tesla cars demonstrate that their engineering is shoddy. Low-quality, slapped-together, and patched-after-the-fact. They just don't have quality in their soul. We should trust these people with... how did Elon Musk put it... "Two ton death machines"
    - 1vuio0pswjnm7 4y ago
      "Giant lithium-ion battery fire." Electric vehicle battery fires can take up to 25,000 gallons of water to extinguish. Combustion engine vehicle fires typically take up to 300 gallons to extinguish. Tesla actually recommmends that firefighters let the battery burnt out rather than try to extinguish the fire. Perhaps someday we will see some researchers perform a remotely-triggered "halt and catch fire" exploit on a "Tesla Energy Product".
fortran77 4y ago
Is this the same system that’s on the Plaid? Or is is just the 3/Y? (My phone near the car works just like the fob did on the S)
- k8sToGo 4y ago
  I think the plaid has this as well now. Older model S didn't have this.
floathub 4y ago
The headline on this had me very confused; surely not even Tesla would implement something like this without a crypto challenge-response in there somewhere? They did not. This attack relies on 2 devices: one next to the car and one next to the phone. It is tunneling the bluetooth link, but you still need an authorized phone at the other end of the tunnel (to respond to the crypto challenge). EDIT: it had me confused because I saw "Relay Attacks" and parsed it as "Replay Attacks". Now getting more coffee ...
- jeroenhd 4y ago
  This is quite a traditional attack going back years at this point. It's also incredible effective and regularly used by car thiefs across the world. The hardware thiefs use to execute the attack sometimes differs per brand or model so it's not a universal attack per se, but leaked data sets about car ownerships make it easy to get a good return on investment for even just a repeater that only works on a single model. These automatically unlocking keys should really be stored in a Faraday cage while not in use. When it comes to phones, well, disable Bluetooth when you're not near your car if you've set up this functionality, I guess…
  - darkerside 4y ago
    > These automatically unlocking keys should really be stored in a Faraday cage while not in use. Those things aren't bullshit? I thought these attacks could only be used while your key was in use.
    - AshamedCaptain 4y ago
      Some keys supposedly have an accelerometer and will stop emitting if the are not moving, but I really have no idea if this is mainstream or a legend. Myself, I have never seen any key that would stop emitting.
      - tomalpha 4y ago
        Ford made a big thing of this a couple of years back[0]. Don't know how many of their models now have it though. [0] https://www.ford.co.uk/support/how-tos/keys-and-locks/door-locks-and-alarms/how-does-the-motion-sensing-key-fob-work https://www.ford.co.uk/support/how-tos/keys-and-locks/door-l...
sixhobbits 4y ago
A bit off topic, but are there any electric cars that are lighter on software? e.g. some or all of a physical key, no touch screens, no over-the-air updates, etc? Something for people who sympathise with [0] > Tech enthusiasts: My entire house is smart. > Tech workers: The only piece of technology in my house is a printer and I keep a gun next to it so I can shoot it if it makes a noise I don't recognize [0] https://twitter.com/ppathole/status/1116670170980859905?lang=en https://twitter.com/ppathole/status/1116670170980859905?lang...
- bjt2n3904 4y ago
  I'm really hoping that the semiconductor shortage forces auto manufacturers to go this route.
  - gtirloni 4y ago
    The shortage is almost over, it's back to business as usual.
    - unixhero 4y ago
      Any sources on this? I'd like to sleep better at night.
    - Denvercoder9 4y ago
      No. Plenty of parts that were previously available without lead time are now quoted for 2024.
      - gtirloni 4y ago
        And many are not.
        Denvercoder9 4y ago
        Of course (it's a shortage, not a complete inavailability), but that there are much more components with long lead times than before makes it decidedly not business as usual.
Nappes 4y ago
Not a big deal 1) This is optional behaviour. By default when you get the car it’s setup with key cards you need to touch to the drivers side door pillar. You have to manually setup phone proximity if you want 2) you can (and probably should) set up a pin code inside the car too. Proximity unlock, which is very useful, gets you in the car but car can’t be driven away until pin is entered
barbegal 4y ago
Virtually every key fob is vulnerable to relay attacks. Yes Teslas use Bluetooth but you can do the same with other radio bands even NFC. Only the latest NFC protocols such as Mifare Plus implement a proximity check function that can help defeat relay attacks. https://link.springer.com/chapter/10.1007/978-3-030-10591-4_7 https://link.springer.com/chapter/10.1007/978-3-030-10591-4_...
- jpgvm 4y ago
  The main reason NFC is resistant to this is it has incredibly tight timings.
- wallaBBB 4y ago
  ToF + RSSI combination on keys is still to be beaten with good protocol. I say with good protocol since "ghost peak" vulnerability is really a protocol issue, but keys don't fall under CCC, and have proprietary ones.
  - AshamedCaptain 4y ago
    This is exactly what they are beating in this article. They claim their relay method is not altering ToF significantly and that the RSSI measurement is useless.
    - wizee 4y ago
      No, it does not beat Time-of-Flight measurement. What it does achieve is keeping GATT response latency within normal ranges, so that the GATT response latency cannot be reliably used as an indication of relay attacks. GATT response latency can vary by tens of milliseconds, whereas Time-of-Flight is usually measured in microseconds or nanoseconds. Unfortunately, Bluetooth LE alone lacks a mechanism for time of flight measurement in secure ranging, hence why technologies like UWB are needed.
- victor106 4y ago
  > Relay Attacks > A relay attack against two > > legitimate parties A and B is > one whereby a man-in-the-> > > middle C forwards A’s messages to B and/or B’s > > messages to A, unbeknown to them. How is this different from a man in the middle attack?
bolangi 4y ago
Is this not a replay attack?
- fabianfabian 4y ago
  replay would be if someone legitimately unlocks the car and the attackers records the communication in order to replay it later. relay is when the attacker takes the bluetooth signal of the owner in gym and relays it to the car in the parking lot.
deleted 4y ago
[deleted]
anselmschueler 4y ago
I believe that wireless electronic unlocking of cars has always been a bad idea. Ever since my neighbors got a new Ford that included a Start button with wireless unlocking a decade or so ago, I’ve been suspicious of the technology. Although many hardware based locks aren’t so hard to overcome either, physical contact between key and device will always be more secure than remote unlocking.
- verytrivial 4y ago
  We had a whole series of cars robbed on my street last week 100% of them were the "proximity keyfob" types. I would be more excited about the shift to electric if it was just the motors and not the endless stream of marginally helpful but insecure and expensive "features" you are forced to buy on new cars now. I mean if manual window winders are cheaper and use less resources, I want those. It's impossible to get them on front doors now.
LeonM 4y ago
These kinds of "sensation" vulnerabilities have been making great headlines every for the past 15 years. However, there is nothing new about this. - Relay attacks are nothing new, and not unique to Tesla. - Every contactless unlock technique is vulnerable to relay attacks. - No amount of encryption prevents relay attacks. - Short range/near field wireless standards (such as NFC) are also vulnerable, though requires close proximity of the attacker to the NFC token (phone/card/keyfob). Even HN often falls victim to these kind of sensational headlines. No, we can't solve this. No, car manufacturers won't go back to physical keys. Yes, 99.9% of consumers really like keyless entry and don't care too much about the potential of theft. For most, that is what insurance is for.
- yc-kraln 4y ago
  > Every contactless unlock technique is vulnerable to relay attacks. > - No amount of encryption prevents relay attacks. This isn't true, and I have the patent(s) to show it. I developed (along with some truly talented security professionals and cryptographers) the active RFID security system for KIWI, a residential access control system here in Germany. One of the requirements, aside from not keeping a central log of access, was that the system should not work if you were further than 10 meters from the door you were trying to open. Things like measuring signal strength, etc. were not an option, as you might imagine repeaters render that moot. Ultimately, it comes down to fairly tight timings, the speed of light and the rules of physics, but we could restrict things such that the cryptographic handshake would fail if you were more than about 30 meters away, corresponding to a timing window of about 0.0000001 seconds. We offered to license the technology to car companies, but they weren't interested.
  - oblio 4y ago
    > We offered to license the technology to car companies, but they weren't interested. Well, I'm sorry for your tech, but you're kind of making OP's point: > Yes, 99.9% of consumers really like keyless entry and don't care too much about the potential of theft. For most, that is what insurance is for.
    - 4y ago
Linda703 4y ago
[dead]
archi42 4y ago
I wonder how they deal with the channel hopping? I remember BT "Classic" derives the hoping sequence from the encryption key. Not sure if that changed significantly for BLE? So either they establish normal connections between relays and victims (meaning two keys, one between each relay and each victim), and then forward data coming out of the Link Layer between the attacker devices - or they need to sniff the whole spectrum in case there is just one key between car and fob. Last time I checked, sniffing the full spectrum of BT required three SDRs, meaning six in total; making this attack rather expensive to pull off (no problem for professional thieves though, I guess). OTOH if they can use any BT stack (or manipulate it with e.g. InternalBlue[1]), potential carjackers just need two Android Phones and good WiFi :( [1] InternalBlue: https://github.com/seemoo-lab/internalblue https://github.com/seemoo-lab/internalblue //edit: I think letting the phone do some sanity checking is already a good idea. There are some indicators that can be used to make this much harder (though not impossible), and which are generally available right now (that is, without additional hardware). The two most obvious: Do the GPS locations match up (prevent theft while at other end of a mall)? Did the acceleration sensors indicate that the phone might have been moved closer to the car (prevent theft while sleeping with phone on the nightstand)?
ninju 4y ago
> This latency margin should be sufficient for conducting long-distance relay attacks over the internet. > However, NCC Group has not attempted any long distance relay attacks against Tesla vehicles. Hmm...so this is a theoretical possibility and never actually performed successfully
4eleven7 4y ago
I don't fully trust my Model 3 with the 'walk away' bluetooth lock. However I do trust the 'pin to drive' (which randomly changes location on screen to foil fingerprints). And sentry mode is a new bonus, not that it has any real utility beyond a small scare for anyone getting too close. There is only so far I'm willing to go for security before securing the item becomes worse than the joy of owning the item. Wheel locks, physical keys, barbed wire perimeter? No thanks. If someone wants to load the car up on a flat bed truck inside of a faraday cage, they've put in the effort, enjoy the car.
kaba0 4y ago
Fortunately someone stealing it won’t get too far away due to the inbuilt paid functionality of hitting a car in the other lane head on!
lizardactivist 4y ago
Much like modern computers and operating systems, with a modern EV like the Tesla it feels a bit like you're not really in full control...
93po 4y ago
More anti Tesla non-news
LeoPanthera 4y ago
Presumably this is only if you disable "PIN to drive", which is on by default.
- Sohcahtoa82 4y ago
  > which is on by default. I bought my Model 3 in 2019 and PIN to drive was certainly not enabled by default.
  - LeoPanthera 4y ago
    Perhaps this has changed, my late 2020 Model X had it on by default.
Balgair 4y ago
Related: Since this is Hacker News, I figured y'all might like this little gadget: https://flipperzero.one/ https://flipperzero.one/ Its utility isn't as bad as the one in the bug report, but I have heard that it can open a lot of other doors on a Tesla (like the charger port).
kcexn 4y ago
It's interesting that Tesla has chosen not to use geofencing for passive keyless entry since the app knows where the car was last parked. It would make sense that if it receives a cryptographic challenge from the car, it would only respond if it was inside of the geofenced boundary for the vehicle, provided by the phone's location services.

233 points by youngtaff 4y ago

This seems to be already discussed here: https://news.ycombinator.com/item?id=31403925 https://news.ycombinator.com/item?id=31403925

bjt2n3904 4y ago

I've never understood car makers obsession with proximity unlock. Let's put it this way: I use biometrics for my phone as convenience, but I have it time out in an hour, and require a pattern. (Or, if I put the phone in lockdown.) The security biometrics offer is too weak to trust. But imagine if the only option you had was face id, and all other options were removed. Operations like unlocking the door must be explicit, not implicit. I'd accept configurability, but it would be permanently disabled if I could. Bluetooth has always sucked, but even if Bluetooth is improved, proximity unlock is brain dead for security.

diebeforei485 4y ago
Auto-lock when out of proximity is a great feature.
- bjt2n3904 4y ago
  It absolutely is! Locking can be implicit -- the assumption should be that the user wants things secure. But imagine working for a company that is very excited about their AI firewall, that intelligently OPENS ports based on a machine learning algorithm. "No! That's a terrible idea!" You exclaim, pulling out tufts of hair. "That has more security holes than a slice of swiss cheese!" "Yeah, but all our focus groups really liked the feature, and when customers hear AI and algorithms they're more likely to buy... Come on, you'd have to basically have a PhD to exploit an algorithm...."
  - roomey 4y ago
    Not to be facetious but there are security products advertised as such (intelligent learning of application behaviours etc etc.
the_mitsuhiko 4y ago
> I've never understood car makers obsession with proximity unlock. Presumably because the feature is well liked. I rarely every use the buttons on my keyfob but always use proximity lock/unlock because it's just much more convenient in practice.
- Ekaros 4y ago
  I would love to have it. It would mean that I would not need to remove key from my pocket if there was also push to start. It always annoys me when I'm carrying something having to fumble and get it out of pocket. Just to press button and then insert it.
- dzhiurgis 4y ago
  My car ties the keys to seat memory - since we share car it's super nice not to fiddle with that. Also just having it somewhere in your pocket, doesn't require you to search for it.
dotancohen 4y ago
> I've never understood car makers obsession with proximity unlock. The competition has it. Some people like it. And in Tesla's case, it saves money. There is no cylinder on the steering column, no cylinder in the door, no steel key to manufacture, no rod going to a physical unlock switch, and no physical unlock switch. So we've saved 500 grams in the car and probably a good $20 too, no to mention the room in the door for the rod and the physical switch, which add engineering work. There is a long tail of removing grams and dollars from the car manufacturing process, and 500 grams and $20 is significant. This long tail is why e.g. the Model 3 uses a touch screen for most controls, why the rear glass extends far into the roof, and many other seemingly-"premium" features of the Model 3. It's actually cheaper to manufacture them this way.
- riffraff 4y ago
  but why use _proximity_ ? You may just as well require a click on the key fob or phone, the cost savings would be exactly the same.
  - brianwawok 4y ago
    It’s great. Walk up to car get in and push gas. Stop it and walk away. No locks to fiddle with, it just works.
- bjt2n3904 4y ago
  > And in Tesla's case, it saves money. There is no cylinder on the steering column, no cylinder in the door... This is precisely what I mean by "brain dead". You'll forgive the hostility, but this is exactly what I'm talking about! Nothing about this list of things REQUIRES proximity unlock. You can still require the user to push a button on their key fob to explicitly unlock the door. I get the convenience factor, I do. If that's a feature you enjoy, then great! All the happiness for you. But give me the chance to opt out of something that is deeply broken from a security perspective. Let me press a fscking button to unlock my car, instead of my car deciding I probably want it to unlock.
  - 4y ago
Tepix 4y ago
My latest car has it and it wasn't optional. I had to buy a faraday bag for my car key.
yreg 4y ago
Proximity unlock is one of my favourite features of my car. I live in a safe region and don't mind having my car unlocked when I'm near it. If it was manual I wouldn't lock it anyway. I agree that it should be configurable, which on Teslas I believe it is.
is_true 4y ago
People love the feel of smart things and a car that unlocks itself when you get close does that. It's your own butler, it makes you feel important.
msh 4y ago
Proximity unlock makes a huge difference when you have a kid on one arm and groceries on the other. You might still be able to operate the doorhandle without putting stuff down but not fiddle around in your pockets. Also teslas dont force proximity unlock, its up to you to set it up.

bin_bash 4y ago

Seems to me the purpose-built NFC spec (used by Apple CarKey) is what Tesla should switch to for this (https://www.businesswire.com/news/home/20200504005161/en/Car-Connectivity-Consortium-Launches-Its-Digital-Key-Release-2.0-Specification https://www.businesswire.com/news/home/20200504005161/en/Car...)

dotancohen 4y ago
Tesla cannot rely on this hardware existing on all devices they target, which include low-end Android devices.
- bin_bash 4y ago
  Therefore they should use this insecure option for everyone? It's possible to have more than 1 radio you know.
  - brianwawok 4y ago
    You can also enable pin to drive. Requires a pin in the car to move it,
- nowherebeen 4y ago
  If you can afford to buy a Tesla, your chances of owning a low-end Android phone is low. I am sure Tesla owners wouldn’t mind buying a new phone for a few hundred bucks to make their car more secure.
  - petepete 4y ago
    Couldn't they just include a dedicated NFC fob? Almost back to the idea of carrying keys around!
    - ashray 4y ago
      They do. Teslas come with two NFC card keys. The phone unlock is optional but really convenient.

diebeforei485 4y ago

This has been an issue with Teslas for a while. Sounds like poor decision-making to use Bluetooth for this. Bluetooth plus UWB (Apple Wallet implementation for some Mercedes models) or Bluetooth plus [ad-hoc] Wi-Fi are reasonable solutions.

AshamedCaptain 4y ago
Maybe UWB is more difficult to relay, but what would exactly Wi-Fi bring to the table ?
- diebeforei485 4y ago
  Time-of-flight calculations so relay attacks wouldn't work well anymore.
mhoad 4y ago
Exactly the kind of engineering team I want in charge of self driving vehicles all over the streets.
- jiggawatts 4y ago
  This may sound like a flippant comment, but it cuts to the heart of the matter: In every aspect, Tesla cars demonstrate that their engineering is shoddy. Low-quality, slapped-together, and patched-after-the-fact. They just don't have quality in their soul. We should trust these people with... how did Elon Musk put it... "Two ton death machines"
  - 1vuio0pswjnm7 4y ago
    "Giant lithium-ion battery fire." Electric vehicle battery fires can take up to 25,000 gallons of water to extinguish. Combustion engine vehicle fires typically take up to 300 gallons to extinguish. Tesla actually recommmends that firefighters let the battery burnt out rather than try to extinguish the fire. Perhaps someday we will see some researchers perform a remotely-triggered "halt and catch fire" exploit on a "Tesla Energy Product".

fortran77 4y ago

Is this the same system that’s on the Plaid? Or is is just the 3/Y? (My phone near the car works just like the fob did on the S)

k8sToGo 4y ago
I think the plaid has this as well now. Older model S didn't have this.

floathub 4y ago

The headline on this had me very confused; surely not even Tesla would implement something like this without a crypto challenge-response in there somewhere? They did not. This attack relies on 2 devices: one next to the car and one next to the phone. It is tunneling the bluetooth link, but you still need an authorized phone at the other end of the tunnel (to respond to the crypto challenge). EDIT: it had me confused because I saw "Relay Attacks" and parsed it as "Replay Attacks". Now getting more coffee ...

jeroenhd 4y ago
This is quite a traditional attack going back years at this point. It's also incredible effective and regularly used by car thiefs across the world. The hardware thiefs use to execute the attack sometimes differs per brand or model so it's not a universal attack per se, but leaked data sets about car ownerships make it easy to get a good return on investment for even just a repeater that only works on a single model. These automatically unlocking keys should really be stored in a Faraday cage while not in use. When it comes to phones, well, disable Bluetooth when you're not near your car if you've set up this functionality, I guess…
- darkerside 4y ago
  > These automatically unlocking keys should really be stored in a Faraday cage while not in use. Those things aren't bullshit? I thought these attacks could only be used while your key was in use.
  - AshamedCaptain 4y ago
    Some keys supposedly have an accelerometer and will stop emitting if the are not moving, but I really have no idea if this is mainstream or a legend. Myself, I have never seen any key that would stop emitting.
    - tomalpha 4y ago
      Ford made a big thing of this a couple of years back[0]. Don't know how many of their models now have it though. [0] https://www.ford.co.uk/support/how-tos/keys-and-locks/door-locks-and-alarms/how-does-the-motion-sensing-key-fob-work https://www.ford.co.uk/support/how-tos/keys-and-locks/door-l...

sixhobbits 4y ago

A bit off topic, but are there any electric cars that are lighter on software? e.g. some or all of a physical key, no touch screens, no over-the-air updates, etc? Something for people who sympathise with [0] > Tech enthusiasts: My entire house is smart. > Tech workers: The only piece of technology in my house is a printer and I keep a gun next to it so I can shoot it if it makes a noise I don't recognize [0] https://twitter.com/ppathole/status/1116670170980859905?lang=en https://twitter.com/ppathole/status/1116670170980859905?lang...

bjt2n3904 4y ago
I'm really hoping that the semiconductor shortage forces auto manufacturers to go this route.
- gtirloni 4y ago
  The shortage is almost over, it's back to business as usual.
  - unixhero 4y ago
    Any sources on this? I'd like to sleep better at night.
  - Denvercoder9 4y ago
    No. Plenty of parts that were previously available without lead time are now quoted for 2024.
    - gtirloni 4y ago
      And many are not.
      - Denvercoder9 4y ago
        Of course (it's a shortage, not a complete inavailability), but that there are much more components with long lead times than before makes it decidedly not business as usual.

Nappes 4y ago

Not a big deal 1) This is optional behaviour. By default when you get the car it’s setup with key cards you need to touch to the drivers side door pillar. You have to manually setup phone proximity if you want 2) you can (and probably should) set up a pin code inside the car too. Proximity unlock, which is very useful, gets you in the car but car can’t be driven away until pin is entered

barbegal 4y ago

Virtually every key fob is vulnerable to relay attacks. Yes Teslas use Bluetooth but you can do the same with other radio bands even NFC. Only the latest NFC protocols such as Mifare Plus implement a proximity check function that can help defeat relay attacks. https://link.springer.com/chapter/10.1007/978-3-030-10591-4_7 https://link.springer.com/chapter/10.1007/978-3-030-10591-4_...

jpgvm 4y ago
The main reason NFC is resistant to this is it has incredibly tight timings.
wallaBBB 4y ago
ToF + RSSI combination on keys is still to be beaten with good protocol. I say with good protocol since "ghost peak" vulnerability is really a protocol issue, but keys don't fall under CCC, and have proprietary ones.
- AshamedCaptain 4y ago
  This is exactly what they are beating in this article. They claim their relay method is not altering ToF significantly and that the RSSI measurement is useless.
  - wizee 4y ago
    No, it does not beat Time-of-Flight measurement. What it does achieve is keeping GATT response latency within normal ranges, so that the GATT response latency cannot be reliably used as an indication of relay attacks. GATT response latency can vary by tens of milliseconds, whereas Time-of-Flight is usually measured in microseconds or nanoseconds. Unfortunately, Bluetooth LE alone lacks a mechanism for time of flight measurement in secure ranging, hence why technologies like UWB are needed.
victor106 4y ago
> Relay Attacks > A relay attack against two > > legitimate parties A and B is > one whereby a man-in-the-> > > middle C forwards A’s messages to B and/or B’s > > messages to A, unbeknown to them. How is this different from a man in the middle attack?

bolangi 4y ago

Is this not a replay attack?

fabianfabian 4y ago
replay would be if someone legitimately unlocks the car and the attackers records the communication in order to replay it later. relay is when the attacker takes the bluetooth signal of the owner in gym and relays it to the car in the parking lot.

deleted 4y ago

[deleted]

anselmschueler 4y ago

I believe that wireless electronic unlocking of cars has always been a bad idea. Ever since my neighbors got a new Ford that included a Start button with wireless unlocking a decade or so ago, I’ve been suspicious of the technology. Although many hardware based locks aren’t so hard to overcome either, physical contact between key and device will always be more secure than remote unlocking.

verytrivial 4y ago
We had a whole series of cars robbed on my street last week 100% of them were the "proximity keyfob" types. I would be more excited about the shift to electric if it was just the motors and not the endless stream of marginally helpful but insecure and expensive "features" you are forced to buy on new cars now. I mean if manual window winders are cheaper and use less resources, I want those. It's impossible to get them on front doors now.

LeonM 4y ago

These kinds of "sensation" vulnerabilities have been making great headlines every for the past 15 years. However, there is nothing new about this. - Relay attacks are nothing new, and not unique to Tesla. - Every contactless unlock technique is vulnerable to relay attacks. - No amount of encryption prevents relay attacks. - Short range/near field wireless standards (such as NFC) are also vulnerable, though requires close proximity of the attacker to the NFC token (phone/card/keyfob). Even HN often falls victim to these kind of sensational headlines. No, we can't solve this. No, car manufacturers won't go back to physical keys. Yes, 99.9% of consumers really like keyless entry and don't care too much about the potential of theft. For most, that is what insurance is for.

yc-kraln 4y ago
> Every contactless unlock technique is vulnerable to relay attacks. > - No amount of encryption prevents relay attacks. This isn't true, and I have the patent(s) to show it. I developed (along with some truly talented security professionals and cryptographers) the active RFID security system for KIWI, a residential access control system here in Germany. One of the requirements, aside from not keeping a central log of access, was that the system should not work if you were further than 10 meters from the door you were trying to open. Things like measuring signal strength, etc. were not an option, as you might imagine repeaters render that moot. Ultimately, it comes down to fairly tight timings, the speed of light and the rules of physics, but we could restrict things such that the cryptographic handshake would fail if you were more than about 30 meters away, corresponding to a timing window of about 0.0000001 seconds. We offered to license the technology to car companies, but they weren't interested.
- oblio 4y ago
  > We offered to license the technology to car companies, but they weren't interested. Well, I'm sorry for your tech, but you're kind of making OP's point: > Yes, 99.9% of consumers really like keyless entry and don't care too much about the potential of theft. For most, that is what insurance is for.
  - 4y ago

Linda703 4y ago

[dead]

archi42 4y ago

I wonder how they deal with the channel hopping? I remember BT "Classic" derives the hoping sequence from the encryption key. Not sure if that changed significantly for BLE? So either they establish normal connections between relays and victims (meaning two keys, one between each relay and each victim), and then forward data coming out of the Link Layer between the attacker devices - or they need to sniff the whole spectrum in case there is just one key between car and fob. Last time I checked, sniffing the full spectrum of BT required three SDRs, meaning six in total; making this attack rather expensive to pull off (no problem for professional thieves though, I guess). OTOH if they can use any BT stack (or manipulate it with e.g. InternalBlue[1]), potential carjackers just need two Android Phones and good WiFi :( [1] InternalBlue: https://github.com/seemoo-lab/internalblue https://github.com/seemoo-lab/internalblue //edit: I think letting the phone do some sanity checking is already a good idea. There are some indicators that can be used to make this much harder (though not impossible), and which are generally available right now (that is, without additional hardware). The two most obvious: Do the GPS locations match up (prevent theft while at other end of a mall)? Did the acceleration sensors indicate that the phone might have been moved closer to the car (prevent theft while sleeping with phone on the nightstand)?

ninju 4y ago

> This latency margin should be sufficient for conducting long-distance relay attacks over the internet. > However, NCC Group has not attempted any long distance relay attacks against Tesla vehicles. Hmm...so this is a theoretical possibility and never actually performed successfully

4eleven7 4y ago

I don't fully trust my Model 3 with the 'walk away' bluetooth lock. However I do trust the 'pin to drive' (which randomly changes location on screen to foil fingerprints). And sentry mode is a new bonus, not that it has any real utility beyond a small scare for anyone getting too close. There is only so far I'm willing to go for security before securing the item becomes worse than the joy of owning the item. Wheel locks, physical keys, barbed wire perimeter? No thanks. If someone wants to load the car up on a flat bed truck inside of a faraday cage, they've put in the effort, enjoy the car.

kaba0 4y ago

Fortunately someone stealing it won’t get too far away due to the inbuilt paid functionality of hitting a car in the other lane head on!

lizardactivist 4y ago

Much like modern computers and operating systems, with a modern EV like the Tesla it feels a bit like you're not really in full control...

93po 4y ago

More anti Tesla non-news

LeoPanthera 4y ago

Presumably this is only if you disable "PIN to drive", which is on by default.

Sohcahtoa82 4y ago
> which is on by default. I bought my Model 3 in 2019 and PIN to drive was certainly not enabled by default.
- LeoPanthera 4y ago
  Perhaps this has changed, my late 2020 Model X had it on by default.

Balgair 4y ago

Related: Since this is Hacker News, I figured y'all might like this little gadget: https://flipperzero.one/ https://flipperzero.one/ Its utility isn't as bad as the one in the bug report, but I have heard that it can open a lot of other doors on a Tesla (like the charger port).

kcexn 4y ago

It's interesting that Tesla has chosen not to use geofencing for passive keyless entry since the app knows where the car was last parked. It would make sense that if it receives a cryptographic challenge from the car, it would only respond if it was inside of the geofenced boundary for the vehicle, provided by the phone's location services.